Correspondent Banking and AML: Why Nested Accounts Are High Risk

Correspondent banking is the arrangement under which one bank, the correspondent, provides an account and payment services to another bank, the respondent. The respondent may be located abroad and use the relationship to clear payments in a currency, access a domestic payment system, settle trade transactions, or serve customers in a market where it has no branch or direct membership.

The model is central to cross-border finance, but it is also a persistent anti-money laundering, or AML, risk. The correspondent bank generally knows its respondent bank directly. It does not normally have a direct relationship with, or full visibility into, every business or individual whose payment passes through the respondent's account. That indirectness is the core control problem.

Why correspondent banking creates AML exposure

A correspondent processes payments based largely on instructions and information supplied through the respondent relationship. Payment messages may identify an originator and beneficiary, but those fields are not a substitute for the correspondent independently onboarding the underlying customer or understanding the purpose of every transaction.

That means a weak respondent can expose its correspondent to proceeds of fraud, corruption, sanctions evasion, terrorist financing, tax crimes, or other illicit activity. The risk is not that correspondent banking is inherently improper. It is that a correspondent can be used to reach major currencies and payment rails by institutions or customers that would otherwise face stronger scrutiny or lack direct access.

A bank's controls must therefore operate at two levels. It must assess whether the respondent has effective customer due diligence, transaction monitoring, sanctions screening, and suspicious activity reporting processes. It must also monitor the correspondent relationship itself for unusual patterns, such as unexplained flows, high-risk counterparties, inconsistent payment purposes, or activity outside the respondent's expected business profile.

Nested relationships and payable-through accounts

A nested, sometimes called downstream, relationship occurs when another financial institution obtains indirect access to a correspondent account through the respondent. For example, Bank A holds a US dollar correspondent account at Bank B, then Bank A uses that access to process payments for Bank C. Bank B may not have a direct contract, due diligence file, or clear risk assessment for Bank C.

Nested activity is not automatically illicit, and it can be a practical way to extend financial access. But it adds another layer between the correspondent and the party generating payments. Each layer can reduce transparency over ownership, customers, geographic exposure, and the quality of AML controls.

Payable-through accounts present a related, often higher-risk structure. In a payable-through account, a foreign bank's own customers can conduct transactions directly through an account maintained at the US correspondent. The foreign bank remains responsible for its customers, but the arrangement can give those customers functionality resembling direct access to the correspondent. US banks must apply enhanced scrutiny where required and understand how access is controlled.

Common risk indicators

• The respondent permits downstream institutions or customer access without transparent controls or prior disclosure.
• Ownership is opaque, politically exposed persons are involved, or adverse media and enforcement history raise integrity concerns.
• Payment activity is inconsistent with the respondent's size, customer base, licensed markets, or stated purpose for the account.
• The respondent operates in, or has material exposure to, jurisdictions with elevated money laundering, terrorist financing, corruption, sanctions, or regulatory risks.
• The respondent cannot demonstrate effective sanctions screening, customer due diligence, transaction monitoring, and suspicious activity escalation.

US legal framework

The USA PATRIOT Act established key requirements for US correspondent banking. Section 312 requires US financial institutions to conduct due diligence, and in specified cases enhanced due diligence, for correspondent accounts established or maintained for foreign banks. The review is risk-based and includes considering the foreign bank's ownership, the nature and extent of its business, the quality of its AML controls, and the relevant jurisdictional environment.

Section 313 generally prohibits US financial institutions from establishing, maintaining, administering, or managing a correspondent account for a foreign shell bank. A foreign shell bank is generally a foreign bank without a physical presence in any country, subject to limited statutory exceptions. Section 313 also addresses indirect access: US banks must take reasonable steps to ensure foreign banks do not use their accounts to provide correspondent services to prohibited shell banks.

These rules sit alongside sanctions obligations, Bank Secrecy Act requirements, and supervisory expectations. Specific obligations depend on the institution, account structure, and facts. This explainer is not legal advice.

How banks evaluate respondent institutions

Before opening or renewing a relationship, a correspondent typically performs a documented risk assessment. It identifies beneficial owners and management, confirms licensing and regulatory status, examines products and customer types, maps geographic exposure, and asks whether the respondent provides payable-through services or permits downstream use.

Banks also test the respondent's AML governance. They may review policies, audit findings, enforcement actions, sanctions controls, onboarding practices, transaction-monitoring capabilities, and the independence of compliance staff. A widely used information-gathering tool is the Wolfsberg Group Correspondent Banking Due Diligence Questionnaire. The questionnaire is an industry standard, not a substitute for a bank's own analysis, verification, and ongoing monitoring.

De-risking and its consequences

De-risking occurs when a bank restricts or exits relationships, customer segments, products, or geographies that it considers too costly or risky to manage. Correspondent banks may do this after finding control weaknesses, sanctions concerns, insufficient transparency, low transaction volumes relative to compliance costs, or uncertainty about regulatory exposure.

The decision can protect a bank from unmanaged risk, but broad exits can have serious consequences. Smaller banks and countries may lose access to dollar, euro, or other clearing services. That can make remittances, trade finance, humanitarian payments, and routine cross-border commerce slower, more expensive, or harder to obtain. It can also push activity toward less transparent channels.

For regulators and banks, the policy challenge is not simply to preserve every relationship or to eliminate every risk. It is to distinguish manageable risk from unacceptable risk, improve transparency in nested structures, and maintain proportionate controls that support legitimate access to the international financial system.